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Abstract 

This paper introduces a new technique for removing ex- 
istential quantifiers over quantum states. Using this tech- 
nique, we show that there is no way to pack an exponential 
number of bits into a polynomial-size quantum state, in such 
a way that the value of any one of those bits can later be 
proven with the help of a polynomial-size quantum witness. 
We also show that any problem in QMA with polynomial- 
size quantum advice, is also in PS PACE with polynomial- 
size classical advice. This builds on our earlier result that 
BQP/qpoly C PP/poly, and offers an intriguing counter- 
point to the recent discovery ofRaz that Ql P /qpoly — ALL. 
Finally, we show that QCMA/qpoly C PP/poly and that 
QMA/rpoly = QMA/poly. 



1. Introduction 

Let Bob be a graduate student, and let x be an n-bit string 
representing his thesis problem. Bob's goal is to learn 
/ {x), where / : {0, 1}" {0, 1} is a function that maps 
every thesis problem to its binary answer ("yes" or "no"). 
Bob knows x (his problem), but is completely ignorant of / 
(how to solve the problem). So to evaluate / (x), he's go- 
ing to need help from his thesis advisor, Alice. Like most 
advisors, Alice is infinitely powerful, wise, and benevolent. 
But also like most advisors, she's too busy to find out what 
problems her students are working on. Instead, she just 
doles out the same advice s to all of them, which she hopes 
will let them evaluate / {x) for any x they might encounter. 
The question is, how long does s have to be, for Bob to be 
able to evaluate / [x) for any xl 

Clearly, the answer is that s has to be 2" bits long — 
since otherwise s will underdetermine the truth table of /. 
Indeed, let g (a;, s) be Bob's best guess as to / (x), given x 
and s. Then even if Alice can choose s probabilistically, 
and we only require that g (a;, s) = f {x) with probability 
at least 2/3 for every x, still one can show that s needs to 
be n (2") bits long. 

'Email: scott@scottaaronson.com. Supported by ARDA, CIAR, and 
IQC. Part of this work was done at Caltech. 



But what if Alice is a quantum advisor, who can send 
Bob a quantum state \tpf)1 Even in that case, Ambainis 
et al. [4J showed that Alice has to send (2"/fi) qubits for 
Bob to succeed with probability at least 2/3 on every x. 
Subsequently Nayak |11| improved this to il(2"), mean- 
ing that there is no quantum improvement over the classical 
bound. Since 2" qubits is too many for Alice to communi- 
cate during her weekly meetings with Bob, it seems Bob is 
out of luck. 

So in desperation. Bob turns for help to Merlin, the star 
student in his department. Merlin knows / as well as x, 
and can thus evaluate / (x). The trouble is that Merlin 
would prefer to take credit for evaluating / (a;) himself, so 
he might deliberately mislead Bob. Furthermore, Merlin 
(whose brilliance is surpassed only by his ego) insists that 
all communication with lesser students be one-way: Bob 
is to listen in silence while Merlin lectures him. On the 
other hand. Merlin has no time to give an exponentially long 
lecture, any more than Alice does. 

With "helpers" like these. Bob might ask, who needs ad- 
versaries? And yet, is it possible that Bob could play Al- 
ice and Merlin against each other — cross-checking Merlin's 
specific but unreliable assertions against Alice's vague but 
reliable advice? In other words, does there exist a random- 
ized protocol satisfying the following properties? 

(i) Alice and Merlin both send Bob poly (n) bits. 

(ii) If MerUn tells Bob the truth about / {x), then there 
exists a message from Merlin that causes Bob to accept 
with probability at least 2/3. 

(iii) If Merlin lies about / (x) (i.e., claims that / (x) = 1 
when / (x) — or vice versa), then no message from 
MerUn causes Bob to accept with probability greater 
than 1/3. 

It is relatively easy to show that the answer is no: if Alice 
sends a bits to Bob and Merlin sends w bits, then for Bob 
to succeed we must have a{w + 1) — (2"). Indeed, this 
is basically tight: for all w > I, there exists a protocol in 
which Merlin sends w bits and Alice sends O + nj bits. 
Of course, even if Merlin didn't send anything, it would 
suffice for Alice to send 2" bits. At the other extreme. 
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if Merlin sends 2" bits, then it suffices for Alice to send 
an O (n)-bit "fingerprint" to authenticate Merlin's message. 
But in any event, either Alice or Merlin will have to send an 
exponentially-long message. 

On the other hand, what if Alice and Merlin can both 
send quantum messages? Our main result will show that, 
even in this most general scenario. Bob is still out of luck. 
Indeed, if Alice sends a qubits to Bob, and Merlin sends 
w qubits, then Bob cannot succeed unless a (w + 1) = 
Q. (2"/rt^). Apart from the n? factor (which we conjec- 
ture can be removed), this implies that no quantum protocol 
is asymptotically better than the classical one. It follows, 
then, that Bob ought to drop out of grad school and send his 
resume to Google. 

1.1. Banishing Merlin 

But why should anyone care about this result, apart from 
Alice, Bob, Merlin, and the Google recruiters? One reason 
is that the proof introduces a new technique for removing 
existential quantifiers over quantum states, which might be 
useful in other contexts. The basic idea is for Bob to loop 
over all possible messages that Merlin could have sent, and 
accept if and only if there exists a message that would cause 
him to accept. The problem is that in the quantum case, 
the number of possible messages from Merlin is doubly- 
exponential. So to loop over all of them, it seems we'd 
first need to amplify Alice's message an exponential num- 
ber of times. But surprisingly, we show that this intuition 
is wrong: to account for any possible quantum message 
from Merlin, it suffices to loop over all possible classical 
messages from Merlin! For, loosely speaking, any quan- 
tum state can eventually be detected by the "shadows" it 
casts on computational basis states. However, turning this 
insight into a "de-Merlinization" procedure requires some 
work: we need to amplify Alice's and Merlin's messages in 
a subtle way, and then deal with the degradation of Alice's 
message that occurs regardless. 

1.2. QMA With Quantum Advice 

In any case, the main motivation for our result is that it 
implies a new containment in quantum complexity theory: 
namely that 

QMA/qpoly C PSPACE/poly. 

Here QMA is the quantum version of MA, and /qpoly 
means "with polynomial-size quantum advice." Previously, 
it was not even known whether QMA/qpoly = ALL, where 
ALL is the class of all languages! Nevertheless, some con- 
text might be helpful for understanding why our new con- 
tainment is of more than zoological interest. 



Aaronson (T] showed that BQP/qpoly C PP/poly, 
where BQP/qpoly is the class of problems solvable in BQP 
with polynomial-size quantum advice. He also gave an or- 
acle relative to which NP BQP/qpoly. Together, these 
results seemed to place strong limits on the power of quan- 
tum advice. 

However, recently Raz Il4l reopened the subject, by 
showing that in some cases quantum advice can be ex- 
traordinarily powerful. In particular, Raz showed that 
QIP (2) /qpoly = ALL, where QIP (2) is the class of prob- 
lems that admit two-round quantum interactive proof sys- 
tems. Raz's result was actually foreshadowed by an obser- 
vation in (2, that PostBQP/qpoly = ALL. Here PostBQP 
is the class of problems solvable in quantum polynomial 
time, if at any time we can measure the computer's state 
and then "postselect" on a particular outcome occurring.' 

These results should make any complexity theorist a lit- 
tle queasy, and not only because jumping from QIP (2) or 
PostBQP to ALL is like jumping from a hilltop to the edge 
of the universe. A more serious problem is that these 
results fail to "commute" with standard complexity inclu- 
sions. For example, even though PostBQP is strictly con- 
tained in BQEXPEXP, notice that BQEXPEXP/qpoly is 
(very) strictly contained in PostBQP/qpoly! 

1.3. The Quantum Advice Hypothesis 

On the other hand, the same pathologies would occur 
with classical randomized advice. For neither the result of 
Raz 1 14 1, nor that of Aaronson 1 1 1, makes any essential use 
of quantum mechanics. That is, instead of saying that 

QIP (2) /qpoly = PostBQP/qpoly = ALL, 

we could equally well have said that 

IP (2) /rpoly = PostBPP/rpoly = ALL, 

where IP (2) and PostBPP are the classical analogues of 
QIP (2) and PostBQP respectively, and / rpoly means "with 
polynomial-size randomized advice." 

Inspired by this observation, here we propose a gen- 
eral hypothesis: that whenever quantum advice behaves like 
exponentially-long classical advice, the reason has nothing 
to do with quantum mechanics. More concretely: 

• The Quantum Advice Hypothesis: For any "natural" 
complexity class C, if C/qpoly = ALL, thenC/rpoly = 
ALL as well. 

'Here is the proof: given a Boolean function / : {0, 1}" {0, 1}. 
take 

IV'") = ^ E !-)!/(-)) 

a:G{0,l}" 

as tlie advice. Then to evaluate / (x) on any x, simply measure \ipn) in 
the standard basis, and then postselect on observing \x) in the first register. 
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The evidence for this hypothesis is simply that we have 
not been able to refute it. In particular, in Appendix 
Qwe will show that QMA/rpoly QMA/poly. So if 
QM A/qpoly contained all languages — which (at least to us) 
seemed entirely possible a priori — then we would have a 
clear counterexample to the hypothesis. In our view, then, 
the significance of the QMA/qpoly C PSPACE/poly re- 
sult is that it confirms the quantum advice hypothesis in the 
most nontrivial case considered so far. 

To summarize, the quantum advice hypothesis has been 
confirmed for at least four complexity classes: BQP, QM A, 
PostBQP, and QIP (2). It remains open for other classes, 
such as QMA (2) (QM A with two unentangled yes-provers) 
and QS2 (QMA with competing yes-prover and no-prover). 

1.4. Outline of Paper 

• Section |2] surveys the complexity classes, communi- 
cation complexity measures, and quantum information 
notions used in this paper. 

• Section|3]states our "De-Merlinization Theorem," and 
then proves three of its implications: (i) a lower 
bound on the QMA communication complexity of ran- 
dom access coding, (ii) a general lower bound on 
QMA communication complexity, and (iii) the inclu- 
sion QMA/qpoly C PSPACE/poly. 

• Section|4]proves the De-Merlinization Theorem itself. 

• Section|5]concludes with some open problems. 

• Appendix0proves a few other complexity results, in- 
cluding QCMA/qpoly C PP/poly and QMA/rpoly = 
QMA/poly. 

2. Preliminaries 

2.1. Complexity Classes 

We assume familiarity with standard complexity classes 
like BQP, P/poly, and MA. The class QMA (Quantum 
Merlin-Arthur) consists of all languages for which a 'yes' 
answer can be verified in quantum polynomial time, given 
a polynomial-size quantum witness state \ip). The com- 
pleteness and soundness errors are 1/3. The class QCMA 
(Quantum Classical Merlin- Arthur) is the same as QMA, 
except that now the witness must be classical. It is not 
known whether QM A = QCM A. See the Complexity Zoo^ 
for more information about these and other classes. 

-http://qwiki.caltech.edu/wiki/Complexity_Zoo 



Given a complexity class C, we write C/poly, C/rpoly, 
and C/qpoly to denote C with polynomial-size determin- 
istic, randomized, and quantum advice respectively.-^ So 
for example, BPP/rpoly is the class of languages decid- 
able by a BPP machine, given a sample from a distribu- 
tion Vn over polynomial-size advice strings which depends 
only on the input length n. It is clear that BPP/rpoly = 
BPP/poly — P/poly. However, in other cases the state- 
ment C/rpoly = C/poly is harder to prove or is even false. 

Admittedly, the /rpoly and /qpoly operators are not 
always well-defined: for example, P/qpoly is just silly, 
and AM/rpoly seems ambiguous (since who gets to sam- 
ple from the advice distribution?). For interactive proof 
classes, the general rule we adopt is that only the verifier 
gets to "measure " the advice. In other words, the prover (or 
provers) knows the advice distribution I?„ or advice state 
\'ipn), but not the actual results of sampling from I?„ or mea- 
suring iV'n) ■ In the case of / rpoly, the justification for this 
rule is that, if the prover knew the sample from I?„, then we 
would immediately get C / rpoly = C/poly for all interactive 
proof classes C, which is too boring. In the case of /qpoly, 
the justification is that the verifier should be allowed to mea- 
sure \%ljn) at any time and in any basis it likes, and it seems 
perverse to require the results of such measurements to be 
relayed instantly to the prover. 

In a private-coin protocol, the verifier might choose to 
reveal some or all of the measurement results to the prover, 
but in a public-coin protocol, the verifier must send a uni- 
form random message that is uncorrelated with the advice. 
Indeed, this explains how it can be true that IP (2) / rpoly 7^ 
AM/rpoly (the former equals ALL, while the latter equals 
N P/ poly), even though Goldwasser and Sipser 1 5 1 famously 
showed that IP (2) = AM in the uniform setting. 

For the complexity classes C that appear in this paper, 
it should generally be obvious what we mean by C/rpoly 
or C/qpoly. But to fix ideas, let us now formally define 
QMA/qpoly. 

Definition 1 QMA/qpoly is the class of languages L C 
{0, 1}* /or which there exists a polynomial-time quantum 
verifier Q, together with quantum advice states {\i^n) }„>i> 
such that for all x G {0, 1}"." 

(i) If X e L, then there exists a quantum witness \ip) 
such that Q accepts with probability at least 2/3 given 
\x) \ipn) \^) input. 

(ii) If X ^ L, then for all pure states'^ |(/?) of the witness 
register, Q accepts with probability at most 1/3 given 
\x) \ipn) \ f) as input. 

^We can also write C/rlog (for C with logarithmic-size randomized 
advice), C/qlog, and so on. 

■^By linearity, this is equivalent to quantifying over all mixed states of 
the witness register 
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Here jV'n) <^nd \ip) both consist of p (n) qubits for some 
fixed polynomial p. Also, Q can accept with arbitrary prob- 
ability if given a state other than \ipn) in the advice register 

One other complexity class we will need is PostBQP, or 
BQP with postselection. 

Definition 2 PostBQP is the class of languages L C 
{0, 1}* for which there exists a polynomial-time quantum 
algorithm such that for all x G {0, 1}", when the algorithm 
terminates: 

( i) The first qubit is 1 1) with nonzero probability. 

(ii) If X ^ L, then conditioned on the first qubit being |1), 
the second qubit is |1) with probability at least 2/3. 

(Hi) If X ^ L, then conditioned on the first qubit being |1), 
the second qubit is 1 1) with probability at most 1/3. 

One can similarly define PostBQPSPACE, 
PostBQEXP, and so on. We will use a result of 
Aaronson |2|, which characterizes PostBQP as simply the 
classical complexity class PP. 

2.2. Communication Complexity 

Let / : {0, 1}^ X {0, 1}*^ {0, 1} be a Boolean 
function. Suppose Alice has an A^-bit string X and Bob 
has an Af-bit string Y . Then (/) is the determinis- 
tic one-way communication complexity of /: that is, the 
minimum number of bits that Alice must send to Bob, for 
Bob to be able to output / (X, Y) with certainty for any 
{X, Y) pair If we let Alice's messages be randomized, and 
only require Bob to be correct with probability 2/3, then 
we obtain ( /), the bounded-error randomized one-way 
communication complexity of /. Finally, if we let Alice's 
messages be quantum, then we obtain (/), the bounded- 
error quantum one-way communication complexity of /.^ 
Clearly (/) < (/) < (/) for all /. See Klauck 
lEl for more detailed definitions of these measures. 

Now suppose that, in addition to a quantum message 
IV'x) from Alice, Bob also receives a quantum witness 
from Merlin, whose goal is to convince Bob that 
/ {X, Y) = 1.^ We say Alice and Bob succeed if for all 
X,Y, 

'We assume no shared randomness or entanglement. Also, we assume 
for simplicity that Alice can only send pure states; note that this increases 
the message length by at most a multiplicative factor of 2 (or an additive 
factor of log A'^, if we use Newman's Theorem 1121 1 

''For convenience, from now on we assume that Merlin only needs to 
prove statements of the form / {X, Y) = 1, not / {X, Y) = 0. For our 
actual results, it will make no difference whether we adopt this assumption 
(corresponding to the class QMA), or the assumption in SectionlTltcorre- 
sponding to QMA n coQMA). 



(i) If / {X, Y) = 1, then there exists a \(p) such that Bob 
accepts \Y) \tpx) \^) with probability at least 2/3. 

(ii) If fiX,Y) = 0, then for all \tp). Bob accepts 
\Y) IV'x) Iv) with probability at most 1/3. 

Call a protocol "(a, w)" if Alice's message consists of a 
qubits and Merlin's consists of w qubits. Then for all inte- 
gers w > 0, we let QMA^ (/) denote the "QMA„, one-way 
communication complexity" of /: that is, the minimum a 
for which there exists an (a, w) protocol such that Alice and 
Bob succeed. Clearly QMA^, (/) < (/), with equality 
when w = 0. 

2.3. Quantum Information 

Here we review some basic facts about mixed states. 
Further details can be found in Nielsen and Chuang II13I 
for example. 

Given two mixed states p and a, the fidelity F (p, a) is 
the maximum possible value of {ip\(p), where and \(p) 
are purifications of p and a respectively. Also, given a 
measurement M, let T>m [p) be the probability distribution 
over measurement outcomes if M is applied to p. Then 
the trace distance ||p — equals the maximum, over all 
possible measurements M, of ||I?a/ [p) — Vm {<y)\\, where 

1 ^ 

\\V-V'\\^-Y,\Pr-p'^\ 
1=1 

is the variation distance between T) = {pi, . . . ,pn) and 
V = {p[, . . . , p'j^ ) . For all p and a, we have the following 
relation between fidelity and trace distance: 

||p-a||t, < ^Jl-F{p,af. 

Throughout this paper, we use Hn to denote iV- 
dimensional Hilbert space. One fact we will invoke re- 
peatedly is that, if / is the maximally mixed state in Hn, 
then 

1 ^ 

where , • ■ • , IV'w)} is any orthonormal basis for Hn- 

3. De-Merlinization and Its Applications 

Our main result, the "De-Merlinization Theorem," al- 
lows us to lower-bound QMA^ (/) in terms of the ordi- 
nary quantum communication complexity (/). In this 
section we state the theorem and derive its implications for 
random access coding (in Section lTTl . one-way communi- 
cation complexity (in Section 13. 2> . and complexity theory 
(in Section l33t . The theorem itself will be proved in Sec- 
tion IH 
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Theorem 3 (De-Merlinization Theorem) For all Boolean 
functions f (partial or total) and all w > 2, 

(/) = 0(QMAi, {f)-wlog'w). 

Furthermore, given an algorithm for the QMA^ protocol. 
Bob can efficiently generate an algorithm for the pro- 
tocol. If the former uses C gates and S qubits of mem- 
ory, then the latter uses C ■ S'O^'^) gates and O {S^ log^ S) 
qubits of memory. 

3.1. Application I: Random Access Coding 

Following Ambainis et al. f4l, let us define the random 
access coding (or RAC) problem as follows. Alice has 
an A^-bit string X — xi . . .xn and Bob has an index i e 
{1, . . . , N}. The players' goal is for Bob to learn Xi. 

In our setting, Bob receives not only an a-bit message 
from Alice, but also a w-hit message from Merlin. If Xi — 
1, then there should exist a message from Merlin that causes 
Bob to accept with probability at least 2/3; while if Xi = 0, 
then no message from Merlin should cause Bob to accept 
with probability greater than 1/3. We are interested in the 
minimum a, w for which Alice and Bob can succeed. 

For completeness, before stating our results for the quan- 
tum case, let us first pin down the classical case — that is, 
the case in which Alice and Merlin both send classical mes- 
sages, and Alice's message can be randomized. Obviously, 
if Merlin sends bits, then Alice needs to send 6 (N) bits; 
this is just the ordinary RAC problem studied by Ambainis 
et al. 0. At the other extreme, if Merlin sends the A^-bit 
message X, then it suffices for Alice to send an O (log A^)- 
bit fingerprint of X. For intermediate message lengths, we 
can interpolate between these two extremes. 

Theorem 4 For all a,w such that aw > N, there exists 
a randomized (a + O (log A^) , w) protocol for RAC — that 
is, a protocol in which Alice sends a + O (log A^) bits and 
Merlin sends w bits. 

Proof. The protocol is as follows: first Alice divides her 
string X — xi . . . Xn into a substrings Yi, . . . , Ya, each at 
most w bits long. She then maps each Yj to an encoded 
substring Y- ^ g (Yj ), where g : {0, 1}™ {0, l}'^ is a 
constant-rate error-correcting code satisfying W = O (w). 
Next she chooses k G {!,..., W} uniformly at random. 
Finally, she sends Bob k (which requires O (log A^) bits of 
communication), together with the k*^ bit of Yj for every 

J G {l,---,a}- 

Now if Merlin is honest, then he sends Bob the substring 
Yj G {0, 1}™ of X containing the Xi that Bob is interested 
in. This allows Bob to learn Xi. Furthermore, if Merlin 
cheats by sending some Y ^ Yj, then Bob can detect this 



with constant probability, by cross-checking the k bit of 
g {Y) against the fc"' bit of Yj as sent by Alice. ■ 

Using a straightforward amplification trick, we can show 
that the protocol of Theorem|4]is essentially optimal. 

Theorem 5 If there exists a randomized (a, w) protocol for 
RAC, then a {w + 1) = Q (N) and a = n (log N). 

Proof. We first show that a{iu + 1) ~ Q (N). First AHce 
amplifies her message to Bob by sending W — O {w + 1) 
independent copies of it. For any fixed message of Mer- 
lin, this reduces Bob's error probability to at most (say) 
2~2{w+i) jjQ^ gQi^ ^^jj ignore Merlin, and loop over all 
2"^ messages z G {0, 1}™ that Merlin could have sent, ac- 
cepting if and only if there exists a z that would cause him 
to accept. This yields an ordinary protocol for the RAC 
problem in which Alice sends aW bits to Bob. But Ambai- 
nis et al. |4| showed that any such protocol requires il (N) 
bits; hence a{w + 1) ^ (N). 

That Alice needs to send il (log A^) bits follows by a sim- 
ple counting argument: let Vx be Alice's message distri- 
bution given an input X. Then Vx and Vy must have 
constant variation distance for all X ^ Y, if Bob is to dis- 
tinguish X from Y with constant bias. ■ 

Together, Theorems |3 and [Sjprovide the complete story 
for the classical case, up to a constant factor. In the quan- 
tum case, the situation is no longer so simple, but we can 
give a bound that is tight up to a polylog factor 

Theorem 6 If there exists a quantum {a,w) protocol for 
RAC, then 

viog'A^y 

Proof. If w = or w = 1 then clearly a = (N), so 
assume w > 2. By Theorem|3] 

(RAC) = O {QMAl (RAC) • w log^ w) 
= O (aw • log^ N) . 

But Nayak (Til showed that (RAC) ^ fl (N), and 
hence aw = Q [N/ log^ A^) . ■ 

Clearly Theorem |6l can be improved when w is very 
small or very large. For when w = 0, we have a — Vl (N); 
while for any w, a simple counting argument (as in the clas- 
sical case) yields a = il (log A^). We believe that Theorem 
|6lcan be improved for intermediate w as well, since we do 
not know of any quantum protocol that beats the classical 
protocol of Theorem^] 

3.2. Application II: One- Way Communica- 
tion 

Theorem |3] yields lower bounds on QMA communica- 
tion complexity, not only for the random access coding 
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problem, but for other problems as well. For Aaronson (T] 
showed the following general relationship between (/) 

and Ql if): 

Theorem 7 (1 1 1) For all Boolean functions f : {0,1}^ x 
{0, 1} — > {0, 1} (partial or total), 

Di(/)-0(A/Qi (/)logQi (/)). 

Combining Theorem with Theorem |3] we obtain the 
following relationship between (/) and QMA^ (/). 
For all / : {0, 1}^ x {0, 1}^^ ^ {0, 1} (partial or total) 
and all w >2, 

Di (/) = O {M ■ w log' w ■ QMA^ (/) log QMA^ (/)) . 

3.3. Application III: Upper-Bounding 
QMA/qpoly 

We now explain why the containment QMA/qpoly C 
PSPACE/poly follows from the De-MerUnization Theo- 
rem. The first step is to observe a weaker result that follows 
from that theorem: 

Lemma 8 QMA/qpoly C BQPSPACE/qpoly. 

Proof. Given a language L e QMA/qpoly, let L„ : 
{0, 1}" — > {0, 1} be the Boolean function defined by 
Ln [x) = 1 if a; g L and L„ [x) — otherwise. Then if we 
interpret Alice's input as the truth table of i„, Bob's input 
as X, and S as the number of qubits used by the QMA/qpoly 
machine, the lemma follows immediately from Theorem|3] 
■ 

Naively, LemmaOmight seem obvious, since it is well- 
known that QMA C PSPACE. But remember that even if 
C C P, it need not follow that C/qpoly C P/qpoly. 

The next step is to replace the quantum advice by classi- 
cal advice. 

Lemma 9 BQPSPACE/qpoly C PostBQPSPACE/poly. 

Proof. Follows from the same argument used by Aaronson 
Id to show that BQP/qpoly C PostBQP/poly. All we 
need to do is replace polynomial time by polynomial space. 
■ 

Finally, we observe a simple generahzation of Watrous's 
theorem ||T5l that BQPSPACE = PSPACE. 

Lemma 10 PostBQPSPACE = PSPACE. 

Proof Sketch. Ladner O showed that PPSPACE = 
PSPACE. Intuitively, given the computation graph of a 
PPSPACE machine, we want to decide in PSPACE whether 
the number of accepting paths exceeds the number of reject- 
ing paths. To do so we use divide-and-conquer, as in the 



proofofSavitch'stheoremthat N PSPACE = PSPACE. An 
obvious difficulty is that the numbers of paths could be dou- 
bly exponential, and therefore take exponentially many bits 
to store. But we can deal with that by computing each bit 
of the numbers separately. Here we use the fact that there 
exist NC^ circuits for addition, and hence addition of 2"-bit 
integers is "locally" in PSPACE. 

If each path is weighted by a complex amplitude, then it 
is easy to see that the same idea lets us sum the amplitudes 
over all paths. We can thereby simulate BQPSPACE and 
PostBQPSPACE in PSPACE as well. ■ 

In particular. Lemma [TO] implies that 
PostBQPSPACE/poly = PSPACE/poly. (For note 
that unlike randomized and quantum advice, determin- 
istic advice commutes with standard complexity class 
inclusions.) 

Putting it all together, we obtain: 

Theorem 11 QMA/qpoly C PSPACE/poly. 

As a final remark, let QAM be the quantum analogue of 
AM, in which Arthur sends a public random string to Mer- 
lin, and then Merlin responds with a quantum state. Marriott 
and Watrous G2I observed that QAM = BP QMA. So 

QAM/qpoly = BP-QMA/qpoly = QMA/qpoly, 

since we can hardwire the random string into the quantum 
advice. Hence QAM/qpoly C PSPACE/poly as well. 
This offers an interesting contrast with the result of Raz Ll?l 
thatQIP(2) /qpoly = ALL. 

4. Proof of The De-Merlinization Theorem 

We now proceed to the proof of Theorem |3] In Sec- 
tion l4.1l we prove several lemmas about damage to quantum 
states, and in particular, the effect of the damage caused 
by earlier measurements of a state on the outcomes of later 
measurements. Section l4~2l then gives our procedure for 
amplifying Bob's error probability, after explaining why the 
more obvious procedures fail. Finally, Section l43l Duts to- 
gether the pieces. 

4.1. Quantum Information Lemmas 

In this section we prove several lemmas that will be 
needed for the main result. The first lemma is a simple 
variant of Lemma 2.2 from 1 1 1; we include a proof for com- 
pleteness. 

Lemma 12 (Almost As Good As New Lemma) Suppose 
a 2-outcome POVM measurement of a mixed state p yields 
outcome 1 with probability e. Then after the measurement, 
and assuming outcome is observed, we obtain a new state 
Pq such that \\p — polltr ^ V^- 
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Proof. Let he a purification of p. Then we can write 

IV') as y/1 — e \ipo) + IV'i)^ where |?/;o) is a purification 
of po and (V'o I V'l) = 0- So the fidelity between p and po is 



Therefore 



The next lemma, which we call the "quantum union 
bound," abstracts one of the main ideas from 

Lemma 13 (Quantum Union Bound) Let p he a mixed 
state, and let {Ai, . . . , At} be a set of 2-outcome POVM 
measurements. Suppose each Af yields outcome 1 with 
probability at most e when applied to p. Then if we ap- 
ply Ai , . . . , Kt in sequence to p, the probability that at least 
one of these measurements yields outcome 1 is at most Ti/e. 

Proof. Follows from a hybrid argument, almost identi- 
cal to Claim 4.1 of Ambainis et al. 101 . More explic- 
itly, by the principle of deferred measurement, we can re- 
place each measurement Aj by a unitary Ut that CNOT's 
the measurement outcome into an ancilla qubit. Let po = 
pig) |0 • • • 0) (0 • • • 0| be the initial state of the system plus T 
ancilla qubits. Then by the same idea as in Lemma[T2l for 
all t we have 



WtPoUt 



So letting 



\Pt+i - Pt\ 



-1 

T 

T-t+1 



Pt ■= Ut - ■ ■ f/T-t+iPoC^T-t+i ■ ■ - Urj.^ 
by unitarity we also have 

UT---UT-tPoUT^^f-U, 

-Ut ■ ■ ■ UT-t+iPoU 
= \\UT~tPoUT^t - Po||^^ 



and hence ||pt — Polltr ^ T^/e by the triangle inequality. 

Now let M be a measurement that returns the logical OR 
of the T ancilla qubits, and let V (p) be the distribution over 
the outcomes (0 and 1) when M is applied to p. Suppose 
M yields outcome 1 with probability p when applied to pT- 
Then since AI yields outcome 1 with probability when 
applied to po, the variation distance ||P (p^) — V (po)|| is 
equal to p. So by the definition of trace distance. 



< Wpt- Po\\t,<T^. 



Finally, we give a lemma that is key to our result. This 
lemma, which we call the "quantum OR bound," is a sort 
of converse to the quantum union bound. It says that, for 
all quantum circuits A and advice states if there exists 
a witness state \lp) such that A accepts \tp) \(p) with high 
probability, then we can also cause A to accept with high 
probability by repeatedly running A on where |j) is 

a random basis state of the witness register, and then tak- 
ing the logical OR of the outcomes. One might worry that, 
as we run A with various |j)'s, the state of the advice reg- 
ister might become corrupted to something far from 
However, we show that if this happens, then it can only be 
because one of the measurements has already accepted with 
high probability. 

Lemma 14 (Quantum OR Bound) Let A be a 2-outcome 
POVM measurement on a bipartite Hilbert space TLa^'Hb- 
Also, Zef {|1) , . . . , I A^)} be any orthonormal basis for "Hb, 
and for all j G {1, • . • , N}, let Aj be the POVM on Ha 
induced by applying A to Ti.A \j)- Suppose there exists a 
product state p®<T in 'Ha®'Hb such that Ayields outcome 1 
with probability at least rj > when applied to p®a. Then 
if we apply Ajj , . . . , Aj^ in sequence to p, where ji, . . . , jt 
are drawn uniformly and independently from {!,..., 
and T > N /rf, the probability that at least one of these 



measurements yields outcome 1 is at least ( rj — \J N /T 



Proof. Let Et denote the event that one of the first t 
measurements of p yields outcome 1. Also, let a :— 



[rj - ^JN/Tj . Then our goal is to show that Pr [Et] > a 

for some t, where the probability is over the choice of 
ji, . . . , Jt as well as the measurement outcomes. Suppose 
Pr [Et] < a for all t; we will derive a contradiction. 

Let Pt be the state in Ha after the first t measurements, 
averaged over all choices of ji, . . . , jt and assuming Et 
does not occur Suppose ||pt — pHtr > for some t. 
Then interpreting the first t measurements as a single mea- 
surement, and taking the contrapositive of Lemma [T2l we 
find that Pr [Et] > a, and we are done. So we can assume 
without loss of generality that [\pt — p[\^^ < y/a for all t. 

For all mixed states ^ in Ha <S^ Hb, let Pa (?) be the 
probability that A yields outcome 1 when applied to By 
the definition of trace distance, we have 

PA(O>^A(0-|k-^'lltr 

for all i^'. Therefore 

PAipt^cr) > PA(p(8)cr) - ||pt(8)cr-p(g)cr|jtj. 
= Pa{p(S(t) - \\pt~ p\\t, 
>rj— yfoL. 

Hence 



Pk {pt ®I)> 



11 - ya 
N ' 
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where 



1 ^ 



is the maximally mixed state in Hb- It follows that for all 

t. 

Now notice that 

Pr [EtrEt-i]= EX [PAipt-i(E>\jt){jt\)] 
ne{i,...M} 

for all t. Furthermore, since £"4-1 Et, the events 
~'Et-i A Et are disjoint. Therefore 



Pr [Et]^J2^' VEt^iAEt] 
t=i 

T 

= ^Pr p-Bt^ilPr [EtpEt^i] 
t=i 

T 

^ (1 - «) . EX [Pa ® {jt 



> 



> (l-a)T 



?7 - V" 



= 1, 



which is certainly greater than a — ~ y/N/Tj . Here 
we are using the fact that T > N/rf', and hence a < 1. ■ 

4.2. Amplification 

Before proceeding further, we need to decrease Bob's 
soundness error (that is, the probability that he accepts a dis- 
honest claim from Merlin). The simplest approach would 
be to have Alice and Merlin both send I copies of their mes- 
sages for some £, and then have Bob run his verification 
algorithm I times in parallel and output the majority an- 
swer However, this approach fails, since the decrease in 
error probability is more than cancelled out by the increase 
in Merlin's message length (recall that we will have to loop 
over all possible classical messages from Merlin). So then 
why not use the "in-place amplification" technique of Mar- 
riott and Watrous 1 101? Because unfortunately, that tech- 
nique only works for Merlin's message; we do not know 
whether it can be generalized to handle Alice's message as 
well.^ Happily, there is a "custom" amplification procedure 
with the properties we want: 

'in any such generalization, certainly Alice will still have to send mul- 
tiple copies of her message. The question is whether Merlin will also have 
to send multiple copies of his message. 



Lemma 15 Suppose Bob receives an a-qubit message \^) 
from Alice and a w-qubit message \ip) from Merlin, where 
w > 2. Let A = O(awlog^w) and W = O (wlogw). 
Then by using A qubits from Alice and W qubits from Mer- 
lin, Bob can amplify his soundness error to while 
keeping his completeness error 1 /3. 

Proof. We will actually use two layers of amplification. In 
the "inner" layer, we replace Alice's message j^/;) by the 
a£-qubit message li/')^^, where I = O (log w). We also re- 
place Merlin's message |</j) by the wi?-qubit message \ ■ 
We then run Bob's algorithm £ times in parallel and output 
the majority answer. By a Chernoff bound, together with 
the same observations used by Kitaev and Watrous 1 6 1 to 
show amplification for QMA, this reduces both the com- 
pleteness and the soundness errors to e = , , for suit- 
able £ = (log u;). 

In the "outer" layer, we replace Alice's message by 
where u — O iW). We then run the inner layer 
u times, once for each copy of , but reusing the same 
register for Merlin's message each time. (Also, after each 
invocation of the inner layer, we uncompute everything ex- 
cept the final answer.) Finally, we output the majority an- 
swer among these u invocations. 

Call Bob's original algorithm Q, and call the amplified 
algorithm Q*. Then our first claim is that if Q accepts 
all w-qubit messages from Merlin with probability at most 
1/3, then accepts all W^-qubit messages with probability 
at most 5^^, for suitable u = O {W). This follows from 
a Chernoff bound — since even if we condition on the first 
through t^^ invocations of the inner layer, the {t + l)*** in- 
vocation will still receive a "fresh" copy of IV')^^, and will 
therefore accept with probability at most e < 1/3. The 
state of Merlin's message register before the {t + 1)** invo- 
cation is irrelevant. 

Our second claim is that, if Q accepts some with 
probability at least 2/3, then Q» accepts {(f)"^^ with prob- 
ability at least 2/3. For recall that a single invocation of 
the inner layer rejects |<p)®^ with probability at most e. So 
by Lemma [O] even if we invoke the inner layer u times 
in sequence, the probability that one or more invocations 
reject is at most u^/e, which is less than 1/3 for suitable 
u^O{W). m 

4.3. Main Result 

We are now ready to prove Theorem |3] that for all 
Boolean functions / and all w > 2, 



Qi(/)-0(QMAi,(/).«;log2 



w 



Furthermore, if Bob uses C gates and S qubits in the 
QMA^ protocol, then he uses C ■ S'^''^^ gates and 
O (S*^ log^ S) qubits in the protocol. 
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Proof of Theorem |31 Let Q be Bob's algorithm. Als 
suppose Alice's message has a qubits and Merlin's messaj 
has w qubits. The first step is to replace Q by the amplifif 
algorithm Q» from LemmalTS] which takes an A-qubit ai 
vice state 1 5') from Alice and a VF-qubit witness state fro 
Merlin, where A — O (aw log^ w) and W = O {w log w 
From now on, we use (|$)) as a shorthand for n 
with witness |$), together with an advice register that ori 
inally contains Alice's message j^I') (but that might becon 
corrupted as Bob uses it). Then Bob's goal is to decic 
whether there exists a |$) such that (|$)) accepts wi 
high probability. 

To do so. Bob uses the following procedure Ai. Give 
Alice's message \'^), this procedure runs Q* (|z)) f 
9 (2^) computational basis states \z) of the witness re 
ister chosen uniformly at random. Finally it returns tl 
logical OR of the measurement outcomes. 

let |c) be a counter initialized to |0) 

fori := lto9(2^) 

choose z e {0,1}'^ uniformly at random 
run Q* (|z)), and let 6 be Q*'s output 

// 1 for accept, for reject 
set |c) := |c + b) 

run Q^^ (|z)) to uncompute garbage 
next t 

if c = then return / {x, y) = 0; 
otherwise return / (x, y) = 1 

Let us first show that Ai is correct. First suppose that 
/ [x, y) = 0. By Lemma [Tsl we know that ac- 
cepts with probability at most for all states |$) of the 
witness register So in particular, {\z)) accepts with 
probability at most S^'^ for all basis states \z). By Lemma 
[T3I it follows that when Ai is finished, the counter c will 
have been incremented at least once (and hence A4 itself 
will have accepted) with probability at most 

9 (2^) 1 
Vh^ 9 

Next suppose that f {x,y) — 1. By assumption, there exists 
a 1$) such that (1$)) accepts with probability at least 
2/3. So setting t] = 2/S, N ^ 2^^, and T = 9 (2^), 
Lemma O implies that A4 will accept with probability at 
least ^ ^ 

It remains only to upper-bound A^'s complexity. If 
Bob's original algorithm Q used C gates and S qubits, then 
clearly the amplified algorithm Q» uses O (C • w log^ 
gates and O (^S ■ w log^ w) qubits. Hence A4 uses 



PP/rpoly = IP(2)/rpoly = ALL 



PSPACE/poly = PSPACE/rpoly 



PP/poly = PostBQP/poly 



QMA/poly = QMA/rpoly 




QMA/qpoly 



QCMA/qpoly 



QCMA/poly = QCMA/rpoly 



BQP/qpoly 



BQP/poly = BQP/rpoly 



Figure 1 . Known containments among classi- 
cal and quantum advice classes. 



gates and O (5^ log^ S) qubits, where we have used the fact 
that w < S. This completes the proof. ■ 

5. Conclusions and Open Problems 

Figure ^ shows the known relationships among deter- 
ministic, randomized, and quantum advice classes, in light 
of this paper's results. We still know remarkably little 
about quantum advice, compared to other computational re- 
sources. But our results provide new evidence for a general 
hypothesis: that if you're strong enough to squeeze an expo- 
nential amount of advice out of a quantum state, then you're 
also strong enough to squeeze an exponential amount of ad- 
vice out of a probability distribution. 

We end with some open problems. 

• Can we find a counterexample to the quantum ad- 
vice hypothesis? What about QMA (2), or QMA (fc) 
for k > 2, or QSj? Currently, we do not even 
know whether QMA (2) /rpoly — ALL; this seems re- 
lated to the difficult open question of amplification for 
QMA (2) (see Kobayashi et al. 1 8 1). 

• Is there a class C such that C/rpoly ^ C/poly but 
C/rpoly ^ ALL? 

• Can we tighten the fl (^N/ log^ lower bound of 
Theorem |6l to il{N)7 One approach would be to 
tighten Lemma [Tsl by generalizing the in-place QMA 
amplification of Marriott and Watrous 1 10 1. 

• Can we improve the containment QMA/qpoly C 
PSPACE/poly to QMA/qpoly C PP/poly? Alterna- 



9 



lively, can we construct an oracle (possibly a 'quan- 
tum oracle' fSl) relative to which QMA/qpoly <f. 
PostBQP/poly? This would indicate that the upper 
bound of PSPACE/poly might be difficult to improve. 
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7. Appendix: Other Complexity Results 

The purpose of this appendix is to show that, in upper- 
bounding QMA/qpoly, the computational difficulty really 
does arise from the need to handle quantum advice and 
quantum witnesses simultaneously: if either or both are "de- 
quantized," then the upper bound of PSPACE/poly can be 
improved. In particular, and in increasing order of nontriv- 
iality. Theorem 1 171 will show that MA/rpoly = MA/poly 
(and likewise that QCMA/rpoly = QCMA/poly), Theorem 
[T9lwill show that QMA/rpoly = QMA/poly, and Theorem 
l20lwill show that QCMA/qpoly C PP/poly. 

First, however, let us make a cautionary observation, 
which illustrates why such upper bounds cannot be blithely 
assumed. Recall that MAexp is the exponential-time ana- 
logue of MA. 

Proposition 16 MAEXp/rpoly = ALL. 

Proof. Given an arbitrary Boolean function / : {0, 1}" 
{0, 1}, an honest Merlin's message will consist of the truth 
table of /, while the randomized advice will consist of an 
O (n)-bit fingerprint of the truth table. ■ 

We can also "scale down" Proposition! 1 61b v an exponen- 
tial, to obtain MA/poly C MA/rlog. IVlore explicitly, in the 
MA/rlog simulation, an honest Merlin's message will con- 
tain the advice s to the MA/poly machine, while the rlog 
advice will consist of an O (log ?i)-bit fingerprint of s. 

We next show that MA/rpoly ~ MA/poly. Combined 
with the above observation, this result has the surprising im- 
plication that 

MA/rlog = NP/poly = MA/poly = MA/rpoly. 

In other words, for an MA machine, poly (n) bits of ran- 
domized advice are no more powerful than log (n) bits. 

Theorem 17 MA/rpoly = MA/poly. 

Proof. Let L be a language in MA/rpoly, and let A (x, r, z) 
be Arthur's verification algorithm run on input x, advice 
string r, and witness z G {0, for some polynomial 

w. (We assume without loss of generality that Arthur is 
deterministic, since the randomized advice can provide his 
coins.) Also, let T) be the distribution from which r is 
drawn. Then for all x G L, there exists a z such that 

2 

Pr [A{x,r,z) accepts] > -, 

rev 3 
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whereas for all x ^ L and all z, 

Pr \A(x^r^z) accepts] < -. 

rGX) 3 

Let R = (ri, . . . , 7'p(„)) be a p (n)-tuple of independent 
samples from T), for some p (n) — 8 (n + it; (n)). Then 
there exists a boosted verifier Ai, such that for all x G L, 
there exists a z such that 

Pr [A^ (x, R, z) accepts] > 1 - ^ } , 

whereas for all x ^ _L and all z, 

Pr [yl, (x, -R, z) accepts] < — — ^-rr- 

So by a simple counting argument, there exists a fixed ad- 
vice string R such that for all x G L, there exists a z such 
that Arthur accepts; whereas for all x ^ L and all z, Arthur 
rejects. ■ 

Indeed, using the same techniques we can show that 



R — (ri, . . . , ^^(n)) be a p (n)-tuple of independent sam- 
ples from V, for some p (n) — Q {n + w (n)). Then there 
exists a boosted verifier such that for all x G L, there 
exists a \(p) such that 

Pr [Q* (x,R, \(p) ) accepts] > 1 - ^ , , , 

whereas for all x ^ L and all \ip), 

Pr [Q* (a:, i?, accepts] < „ , 

So by a simple counting argument, there exists a fixed ad- 
vice string i?i such that for all x E L, there exists a |(^) such 
that Arthur accepts with probability at least 1 — 2^'^"'("\ 
However, we still need to handle the case x ^ L. Since the 
number of states \ip) e ^®™(") ^jj-jj gu^^jj pairwise inner 
product is doubly exponential, a naive counting argument 
no longer works. Instead, observe that there exists a fixed 
advice string Rq such that for all x ^ L and all computa- 
tional basis states \z) with z € {0, l}'"'^"^ 



QCMA/rlog = QCMA/qlog = QCMA/poly = QCMA/rpoly. Pr [Q, (x, Rq, \z)) accepts] < 2"2"'(") 



1 



2n23ti)(n) 



Next we want to show a somewhat harder result, that 
QMA/rpoly = QMA/poly. To do so we will need the 
following theorem of Marriott and Watrous. 

Theorem 18 (Marriott and Watrous QSl) The error 
probability in any QMA protocol can be made exponen- 
tially small without increasing the size of Merlin 's quantum 
witness. 

We can now prove the analogue of TheoremfTTlfor QMA. 

Theorem 19 QMA/rpoly = QMA/poly. 

Proof. Given a language L e QMA/rpoly, let V be the 
distribution from which Arthur's advice is drawn, and let 
Q {x, r, \(p)) be Arthur's verification algorithm run on input 
X, advice string r, and witness \ip) £ TL®^'^"'\ Then foraU 
X £ L, there exists a | ip) such that 



Pr [Q{x,r,\ip)) accepts] > -, 
rev 6 



1 



22m(n) ■ 



Now suppose by contradiction that there exists a | (p) such 
that 

Pr[Q* ix,Ro, \ip)) accepts] > -. 



Then 



where 



Pr[Q* {x,Ro,I) accepts] > 



1 1 



3 2"'(") ' 



1 



E 



is the maximally mixed state on w (n) qubits. But this 
implies that there exists a basis state \z) such that 

Pr [Q* {x, Rq, \z)) accepts] > i 



whereas for all x ^ L and all ] ip) , 



3 2"'(") ' 

which yields the desired contradiction. Finally, by a union 
bound, there exists a fixed advice string R that combines the 
properties of i?o and i?i . ■ 



Pr [Q{x,r,\ip)) accepts] < -. 
rev 3 

Here the probability is taken over Q's internal randomness 
as well as r. 

By Theorem we can make the error probability ex- 
ponentially small without increasing the size of lip). So let 



7.1. Upper-Bounding QCMA/qpoly 

We now show that QCMA/qpoly C PP/poly. Concep- 
tually, the proof is similar to the proof that QMA/qpoly C 
PSPACE/poly, but with three differences. First, since the 
witnesses are now classical, they can be provided to the 
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simulating machine as part of the advice. Second, since 
the witnesses are provided, there is no longer any need to 
try exponentially many random witnesses. Indeed, this 
is what improves the upper bound from PS PACE/ poly to 
PP/poly. And third, we can no longer exploit the fact that 
BQPSPACE/qpoly = PSPACE/poly, in order to split the 
proof neatly into a "de-Merlinization" part (which is new) 
and an "advice" part (which follows from earlier work of 
Aaronson [jj). Instead, we need to generalize the machin- 
ery from ID to the QCMA settmg. 

Theorem 20 QCMA/qpoly C PP/poly. 

Proof. Let L be a language in QCMA/qpoly, and let 

L {x) = 1 if x e L and L (x) — otherwise. Also, let 
Q be a verifier for L, which takes a a-qubit quantum advice 
state I?/') and w-bit classical witness z for some polynomi- 
als a and w (for convenience, we omit the dependence on 
n). Then the first step is to replace Q by an amplified veri- 
fier Q*, which takes an A-qubit advice state j^*) := {ip)^^, 
where A — a£ and I = O (logo). As a result, has 
completeness and soundness errors l/A^. 

Let [x, p, z) be shorthand for run with input x, 
advice p, and witness z. Then given x, our goal is to sim- 
ulate (x, l^*) , z {x)), where z {x) is an optimal witness 
for x. We will do so using a PP/poly machine Ai. The 
classical advice to will consist of a "Darwinian training 
set" (a;i, zi) , . . . , {xt, zt) for T = O {A), together with 
L {xt) for every i € {1, . . . , T}. Here each xt G {0, 1}" 
is an input and each zt G {0, 1}™ is its corresponding wit- 
ness. Given this advice, Ai runs the following procedure 
to compute L{x). 

let p := I A be the maximally mixed state on A qubits 

fort := ItoT 

let \b) be a qubit initialized to |0) 
run Q, [xt, p, zt), and CNOT the output into \b) 
run Q^^ {xt, p, Zt) to uncompute gai'bage 
measure \ b), and postselect on observing h = L{xt) 

next t 

for all z e {0, ly, 

let be the probability that Q^, {x, p, z) accepts 
if there exists a z such that > 2/3, then accept 
otherwise, if Az < 1 /3 for all z, then reject 

Let us first see why Ai can be simulated in PP/poly. 
The 'for' loop is just a postselected quantum computation, 
and can clearly be simulated by the result of Aaronson Q 
that PostBQP = PP. The one nontrivial step is to decide 
whether there exists a z such that Xz > 2/3, or whether 
Xz < 1/3 for all z. We do this as follows. Let pt be 
the state of the advice register after the first t postselection 
steps, conditioned on those steps succeeding. We first am- 
plify by repeating the 'for' loop J = O (w) times, using a 



different advice register each time. This yields J copies of 
Pt- We then replace {x, pT, z) by the doubly-amplified 
verifier Q'^ (x, p®"^, z), which runs Q» {x, pT, z) once for 
each of the J advice registers, and returns the majority out- 
come. Let A^ be the probabiHty that Q'^ [x,p®'^ ,z^ ac- 
cepts. Then by a Chernoff bound, and assuming the con- 
stant in J = O [w] is sufficiently large, we have reduced 
the problem to deciding whether 

(1) there exists a z e {0, 1}™ such that A^ > 1 - 2-2™, or 

(2) a; < 2-2'^' for all z. 
Now let 

ze{o,i}™ 

Then S > 2-"'-i in case (1), whereas S < 2-2"' in case 
(2). So it suffices to give a PP/poly machine with a + (3S 
accepting paths, for some positive constants a and jS. Our 
machine will simply do the following: 

• Choose z uniformly at random. 

• Simulate a PostBQP computation that accepts with 
probability proportional to A^. 

The reason this works is that the probability of the T 
postselection steps in the 'for' loop all succeeding is inde- 
pendent of z. 

It remains only to show Ai's correctness. Let pt be 
the probability that the first t postselection steps in the 
'for' loop all succeed. We choose the "training inputs" 
xi, . . . ,xt and witnesses zi , . . . , zt in such a way that 

(a) Pt+i < Ipt for alH e {0, . . . , T - 1}. 

(b) Zt is a valid witness for xt whenever xt G L, meaning 
that Q* [xt, Y^) , Zt) accepts with probability at least 

1-1/A^. 

(c) There is no larger training set that satisfies (a) and (b). 
Then it suffices to prove the following two claims: 

(i) T = O (A) for all training sets that satisfy (a) and (b). 

(ii) M correctly decides every input x, if we train it on 
some (xi, zi) , . . . , {xt, zt) that satisfies (a), (b), and 
(c). 

For Claim (i), notice that we can write the maximally 
mixed state / as a mixture of 2"^ orthonormal vectors 

2^ 
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where :— j^*) is the "true" advice state. We ar- 

gue that the (vj^i | component must survive all T post- 
selection steps with high probability. For if xt 4- 
then {xt, \ '^) , zt) accepts with probability at most l/A^, 
while if Xt E L, then {xt, , zt) rejects with probabil- 
ity at most l/A^ by assumption (b). So by Lemma [Tsl 
the probability of outputting the wrong answer on any of 
(xi, zi) , . . . , {xt, Zt), using as the advice, is at most 
T\/l/A4 =T/A^. Hence 

On the other hand, pt+i < ^pt for all t by assumption 
(a), and hence pT < (2/3)^. Combining we obtain 

T = (A). 

For Claim (ii), suppose by way of contradiction that 
A4 rejects some x £ L. Then {x, pr, z) ac- 
cepts with probability less than 2/3 for all z. But 
this implies that if we trained Ai on the enlarged set 
(xi, zi) , . . . , (xt, Zt) , (x, z) for any z, then we would get 
Pt+1 < \pt, thereby contradicting the maximality of T. 
Likewise, suppose M accepts some x ^ L. Then there ex- 
ists a "false witness" z such that (x, pT, 'z) accepts with 
probability greater than 1/3. So if we trained M. on the 
enlarged set (xi, zi) . . . . , (xt, zt) , (x, z), we would again 
get pt+1 < |pt, contradicting the maximality of T. ■ 
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